43 matches found
WPForms Pro <= 1.10.1.1 - Unauthenticated Arbitrary File Upload
WPForms Pro for WordPress up to and including 1.10.1.1 allows unauthenticated arbitrary file upload. The wpformsuploadchunkinit, wpformsuploadchunk and wpformsfilechunksuploaded AJAX actions are registered for unauthenticated visitors without a nonce check, and raw chunk bytes are written under...
CVE-2026-10818
CVE-2026-10818 WPForms Pro = 1.10.1.1 — Неаутентифицированная произвольная запись файла через порядок инициализации/финализации чанковой загрузки CVE-2026-10818 WPForms Pro ≤ 1.10.1.1 — Неаутентифицированная произвольная запись файла через чанковую загрузку Эксплойт PoC Порядок...
WordPress WPForms Pro plugin has a cross-site scripting vulnerability
The WordPress WPForms Pro plugin is one of the most popular paid versions of form plugins on WordPress. The WPForms Pro plugin has a cross-site scripting vulnerability, which stems from insufficient input cleaning and output escaping for values of the Single Line Text and Paragraph Text Fields. N...
WordPress WPForms Pro plugin <= 2.0.0.2 - Unauthenticated Stored Cross-Site Scripting via Single Line Text and Paragraph Text Field Values vulnerability
Unauthenticated Stored Cross-Site Scripting via Single Line Text and Paragraph Text Field Values vulnerability discovered by daroo in WordPress Plugin WPForms Pro versions = 2.0.0.2...
CVE-2026-18409
The WPForms Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Single Line Text and Paragraph Text Field Values in all versions up to, and including, 2.0.0.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...
CVE-2026-18409
WPForms Pro for WordPress (all versions ≤ 2.0.0.2 ) is vulnerable to unauthenticated Stored XSS via Single Line Text and Paragraph Text Field values. The root cause is the plugin's own wp_kses_allowed_html filter, which widens the 'post' allowlist to permit iframe elements with a data-src attribu...
CVE-2026-18409 WPForms Pro <= 2.0.0.2 - Unauthenticated Stored Cross-Site Scripting via Single Line Text and Paragraph Text Field Values
The WPForms Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Single Line Text and Paragraph Text Field Values in all versions up to, and including, 2.0.0.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...
EUVD-2026-63812
The WPForms Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Single Line Text and Paragraph Text Field Values in all versions up to, and including, 2.0.0.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...
PT-2026-79293
The WPForms Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Single Line Text and Paragraph Text Field Values in all versions up to, and including, 2.0.0.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...
CVE-2026-18409: Improper Neutralization of Input During Web Page Generation
The WPForms Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Single Line Text and Paragraph Text Field Values in all versions up to, and including, 2.0.0.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...
Exploit for CVE-2026-10818
CVE-2026-10818 WPForms Pro = 1.10.1.1 - Unauthenticated Ar...
CVE-2026-10818
The WPForms Pro plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.10.1.1 via the ajaxchunkuploadfinalize function. This is due to the file type validation occurring after chunk metadata and file contents have already been written to disk, and the...
CVE-2026-10818
WPForms Pro (WordPress) is affected by an Arbitrary File Upload vulnerability up to version 1.10.1.1, exploitable via the ajax_chunk_upload_finalize path. The issue arises because file type validation occurs after chunk metadata and file contents are written to disk, and the assembled file isn’t ...
CVE-2026-10818 WPForms Pro <= 1.10.1.1 - Unauthenticated Arbitrary File Write via Chunked Upload Init/Finalize Ordering
The WPForms Pro plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.10.1.1 via the ajaxchunkuploadfinalize function. This is due to the file type validation occurring after chunk metadata and file contents have already been written to disk, and the...
CVE-2026-10818 WPForms Pro <= 1.10.1.1 - Unauthenticated Arbitrary File Write via Chunked Upload Init/Finalize Ordering
The WPForms Pro plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.10.1.1 via the ajaxchunkuploadfinalize function. This is due to the file type validation occurring after chunk metadata and file contents have already been written to disk, and the...
CVE-2026-10818: Unrestricted Upload of File with Dangerous Type
The WPForms Pro plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.10.1.1 via the ajaxchunkuploadfinalize function. This is due to the file type validation occurring after chunk metadata and file contents have already been written to disk, and the...
EUVD-2022-42938
Malicious code in bioql PyPI...
EUVD-2023-34915
Malicious code in bioql PyPI...
